chef 17.7.22-universal-mingw32 → 17.9.26-universal-mingw32

data/lib/chef/resource/habitat_install.rb

@@ -52,8 +52,8 @@ class Chef
       property :name, String, default: "install habitat",
         description: "Name of the resource block. This has no impact other than logging."
 
-      property :install_url, String, default: "https://raw.githubusercontent.com/habitat-sh/habitat/master/components/hab/install.sh",
-        description: "URL to the install script, default is from the [habitat repo](https://raw.githubusercontent.com/habitat-sh/habitat/master/components/hab/install.sh) ."
+      property :install_url, String, default: "https://raw.githubusercontent.com/habitat-sh/habitat/main/components/hab/install.sh",
+        description: "URL to the install script, default is from the [habitat repo](https://raw.githubusercontent.com/habitat-sh/habitat/main/components/hab/install.sh) ."
 
       property :bldr_url, String,
         description: "Optional URL to an alternate Habitat Builder."

data/lib/chef/resource/homebrew_tap.rb

@@ -41,10 +41,6 @@ class Chef
       property :url, String,
         description: "The URL of the tap."
 
-      property :full, [TrueClass, FalseClass],
-        description: "Perform a full clone on the tap, as opposed to a shallow clone.",
-        default: false
-
       property :homebrew_path, String,
         description: "The path to the Homebrew binary.",
         default: "/usr/local/bin/brew"
@@ -57,7 +53,7 @@ class Chef
       action :tap, description: "Add a Homebrew tap." do
         unless tapped?(new_resource.tap_name)
           converge_by("tap #{new_resource.tap_name}") do
-            shell_out!("#{new_resource.homebrew_path} tap #{new_resource.full ? "--full" : ""} #{new_resource.tap_name} #{new_resource.url || ""}",
+            shell_out!("#{new_resource.homebrew_path} tap #{new_resource.tap_name} #{new_resource.url || ""}",
               user: new_resource.owner,
               env:  { "HOME" => ::Dir.home(new_resource.owner), "USER" => new_resource.owner },
               cwd: ::Dir.home(new_resource.owner))

data/lib/chef/resource/inspec_waiver_file_entry.rb

@@ -135,7 +135,7 @@ class Chef
 
       action_class do
         def load_waiver_file_to_hash(file_name)
-          if file_name =~ %r{(/|C:\\).*(.yaml|.yml)}i
+          if %r{(/|C:\\).*(.yaml|.yml)}i.match?(file_name)
             if ::File.exist?(file_name)
               hash = ::YAML.load_file(file_name)
               if hash == false || hash.nil? || hash == ""

data/lib/chef/resource/launchd.rb

@@ -84,7 +84,7 @@ class Chef
                   end
 
           # Check to make sure that our array only has hashes
-          unless array.all? { |obj| obj.is_a?(Hash) }
+          unless array.all?(Hash)
             error_msg = "start_calendar_interval must be a single hash or an array of hashes!"
             raise Chef::Exceptions::ValidationFailed, error_msg
           end
@@ -98,7 +98,7 @@ class Chef
               raise Chef::Exceptions::ValidationFailed, error_msg
             end
 
-            unless entry.values.all? { |val| val.is_a?(Integer) }
+            unless entry.values.all?(Integer)
               failed_values = entry.values.reject { |val| val.is_a?(Integer) }.join(", ")
               error_msg = "Invalid value(s) (#{failed_values}) for start_calendar_interval item.  Values must be integers!"
               raise Chef::Exceptions::ValidationFailed, error_msg
@@ -238,9 +238,6 @@ class Chef
       property :time_out, Integer,
         description: "The amount of time (in seconds) a job may be idle before it times out. If no value is specified, the default timeout value for launchd will be used."
 
-      property :umask, Integer,
-        description: "A decimal value to pass to `umask` before running a job."
-
       property :username, String,
         description: "When launchd is run as the root user, the user to run the job as."
 

data/lib/chef/resource/macos_userdefaults.rb

@@ -17,6 +17,7 @@
 
 require_relative "../resource"
 require "chef-utils/dist" unless defined?(ChefUtils::Dist)
+require "corefoundation" if RUBY_PLATFORM.match?(/darwin/)
 autoload :Plist, "plist"
 
 class Chef
@@ -80,8 +81,7 @@ class Chef
       property :host, [String, Symbol],
         description: "Set either :current, :all or a hostname to set the user default at the host level.",
         desired_state: false,
-        introduced: "16.3",
-        coerce: proc { |value| to_cf_host(value) }
+        introduced: "16.3"
 
       property :value, [Integer, Float, String, TrueClass, FalseClass, Hash, Array],
         description: "The value of the key. Note: With the `type` property set to `bool`, `String` forms of Boolean true/false values that Apple accepts in the defaults command will be coerced: 0/1, 'TRUE'/'FALSE,' 'true'/false', 'YES'/'NO', or 'yes'/'no'.",
@@ -95,8 +95,7 @@ class Chef
 
       property :user, [String, Symbol],
         description: "The system user that the default will be applied to. Set :current for current user, :all for all users or pass a valid username",
-        desired_state: false,
-        coerce: proc { |value| to_cf_user(value) }
+        desired_state: false
 
       property :sudo, [TrueClass, FalseClass],
         description: "Set to true if the setting you wish to modify requires privileged access. This requires passwordless sudo for the `/usr/bin/defaults` command to be setup for the user running #{ChefUtils::Dist::Infra::PRODUCT}.",
@@ -117,7 +116,7 @@ class Chef
       action :write, description: "Write the value to the specified domain/key." do
         converge_if_changed do
           Chef::Log.debug("Updating defaults value for #{new_resource.key} in #{new_resource.domain}")
-          CF::Preferences.set!(new_resource.key, new_resource.value, new_resource.domain, new_resource.user, new_resource.host)
+          CF::Preferences.set!(new_resource.key, new_resource.value, new_resource.domain, to_cf_user(new_resource.user), to_cf_host(new_resource.host))
         end
       end
 
@@ -127,39 +126,35 @@ class Chef
 
         converge_by("delete domain:#{new_resource.domain} key:#{new_resource.key}") do
           Chef::Log.debug("Removing defaults key: #{new_resource.key}")
-          CF::Preferences.set!(new_resource.key, nil, new_resource.domain, new_resource.user, new_resource.host)
+          CF::Preferences.set!(new_resource.key, nil, new_resource.domain, to_cf_user(new_resource.user), to_cf_host(new_resource.host))
         end
       end
 
       def get_preference(new_resource)
-        CF::Preferences.get(new_resource.key, new_resource.domain, new_resource.user, new_resource.host)
+        CF::Preferences.get(new_resource.key, new_resource.domain, to_cf_user(new_resource.user), to_cf_host(new_resource.host))
       end
 
-      action_class do
-        require "corefoundation" if RUBY_PLATFORM.match?(/darwin/)
-
-        # Return valid hostname based on the input from host property
-        def to_cf_host(value)
-          case value
-          when :all
-            CF::Preferences::ALL_HOSTS
-          when :current
-            CF::Preferences::CURRENT_HOST
-          else
-            value
-          end
+      # Return valid hostname based on the input from host property
+      def to_cf_host(value)
+        case value
+        when :all
+          CF::Preferences::ALL_HOSTS
+        when :current
+          CF::Preferences::CURRENT_HOST
+        else
+          value
         end
+      end
 
-        # Return valid username based on the input from user property
-        def to_cf_user(value)
-          case value
-          when :all
-            CF::Preferences::ALL_USERS
-          when :current
-            CF::Preferences::CURRENT_USER
-          else
-            value
-          end
+      # Return valid username based on the input from user property
+      def to_cf_user(value)
+        case value
+        when :all
+          CF::Preferences::ALL_USERS
+        when :current
+          CF::Preferences::CURRENT_USER
+        else
+          value
         end
       end
     end

data/lib/chef/resource/powershell_package_source.rb

@@ -25,10 +25,10 @@ class Chef
 
       provides :powershell_package_source
 
-      description "Use the **powershell_package_source** resource to register a PowerShell package source and a Powershell package provider. There are 2 distinct objects we care about here. The first is a Package Source like a PowerShell Repository or a Nuget Source. The second object is a provider that PowerShell uses to get to that source with, like PowerShellGet, Nuget, Chocolatey, etc. "
+      description "Use the **powershell_package_source** resource to register a PowerShell package source and a Powershell package provider. There are two distinct objects we care about here. The first is a package source like a PowerShell repository or a NuGet Source. The second object is a provider that PowerShell uses to get to that source with, like PowerShellGet, NuGet, Chocolatey, etc."
       introduced "14.3"
       examples <<~DOC
-        **Add a new PSRepository that is not trusted and which requires credentials to connect to**:
+        **Add a new PowerShell repository that is not trusted and which requires credentials to connect to**:
 
         ```ruby
         powershell_package_source 'PowerShellModules' do
@@ -43,7 +43,7 @@ class Chef
         end
         ```
 
-        **Add a new Package Source that uses Chocolatey as the Package Provider**:
+        **Add a new package source that uses Chocolatey as the package provider**:
 
         ```ruby
         powershell_package_source 'PowerShellModules' do
@@ -56,7 +56,7 @@ class Chef
         end
         ```
 
-        **Add a new PowerShell Script source that is trusted**:
+        **Add a new PowerShell script source that is trusted**:
 
         ```ruby
         powershell_package_source 'MyDodgyScript' do
@@ -68,7 +68,7 @@ class Chef
         end
         ```
 
-        **Update my existing PSRepository to make it Trusted after all**:
+        **Update an existing PowerShell repository to make it trusted**:
 
         ```ruby
         powershell_package_source 'MyPSModule' do
@@ -137,7 +137,7 @@ class Chef
         description: "The location where scripts will be published to for this source. Only valid if the provider is `PowerShellGet`."
 
       property :trusted, [TrueClass, FalseClass],
-        description: "Whether or not to trust packages from this source. Used when creating a NON-PSRepository Package Source",
+        description: "Whether or not to trust packages from this source. Used when creating a non-PowerShell repository package source.",
         default: false
 
       property :user, String,
@@ -151,7 +151,7 @@ class Chef
       property :provider_name, String,
         equal_to: %w{ Programs msi NuGet msu PowerShellGet psl chocolatey winget },
         validation_message: "The following providers are supported: 'Programs', 'msi', 'NuGet', 'msu', 'PowerShellGet', 'psl', 'chocolatey' or 'winget'",
-        description: "The package management provider for the package source. The default is PowerShellGet and this option need only be set otherwise in specific use cases.",
+        description: "The package management provider for the package source. The default is `PowerShellGet`. Only change this option in specific use cases.",
         default: "NuGet"
 
       load_current_value do
@@ -202,7 +202,7 @@ class Chef
         end
       end
 
-      action :set, description: "Updates an existing PSRepository or Package Source" do
+      action :set, description: "Updates an existing PowerShell repository or package source." do
         package_details = get_package_source_details
         output = package_details.result
         if output == "PSRepository"

data/lib/chef/resource/remote_file.rb

@@ -138,7 +138,7 @@ class Chef
           nil
         elsif args[0].is_a?(Chef::DelayedEvaluator) && args.count == 1
           args[0]
-        elsif args.any? { |a| a.is_a?(Chef::DelayedEvaluator) } && args.count > 1
+        elsif args.any?(Chef::DelayedEvaluator) && args.count > 1
           raise Exceptions::InvalidRemoteFileURI, "Only 1 source argument allowed when using a lazy evaluator"
         else
           Array(args).flatten

data/lib/chef/resource/rhsm_register.rb

@@ -79,6 +79,23 @@ class Chef
         default: false, desired_state: false,
         introduced: "15.9"
 
+      property :server_url, String,
+        description: "The hostname of the subscription service to use. The default is Customer Portal Subscription Management, subscription.rhn.redhat.com. If you do not use this option, the system registers with Customer Portal Subscription Management.",
+          introduced: "17.8"
+
+      property :base_url, String,
+        description: "The hostname of the content delivery server to use to receive updates. Both Customer Portal Subscription Management and Subscription Asset Manager use Red Hat's hosted content delivery services, with the URL https://cdn.redhat.com. Since Satellite 6 hosts its own content, the URL must be used for systems registered with Satellite 6.",
+        introduced: "17.8"
+
+      property :service_level, String,
+        description: "Sets the service level to use for subscriptions on the registering machine. This is only used with the `auto_attach` option.",
+        introduced: "17.8"
+
+      property :release,
+        [Float, String],
+        description: "Sets the operating system minor release to use for subscriptions for the system. Products and updates are limited to the specified minor release version. This is used only used with the `auto_attach` option.  For example, `release '6.4'` will append `--release=6.4` to the register command.",
+        introduced: "17.8"
+
       action :register, description: "Register the node with RHSM." do
         package "subscription-manager"
 
@@ -170,6 +187,8 @@ class Chef
               command << new_resource.activation_key.map { |key| "--activationkey=#{Shellwords.shellescape(key)}" }
               command << "--org=#{Shellwords.shellescape(new_resource.organization)}"
               command << "--name=#{Shellwords.shellescape(new_resource.system_name)}" if new_resource.system_name
+              command << "--serverurl=#{Shellwords.shellescape(new_resource.server_url)}" if new_resource.server_url
+              command << "--baseurl=#{Shellwords.shellescape(new_resource.base_url)}" if new_resource.base_url
               command << "--force" if new_resource.force
 
               return command.join(" ")
@@ -179,11 +198,23 @@ class Chef
           if new_resource.username && new_resource.password
             raise "Unable to register - you must specify environment when using username/password" if new_resource.environment.nil? && using_satellite_host?
 
+            if new_resource.service_level
+              raise "Unable to register - 'auto_attach' must be enabled when using property `service_level`." unless new_resource.auto_attach
+            end
+
+            if new_resource.release
+              raise "Unable to register - `auto_attach` must be enabled when using property `release`." unless new_resource.auto_attach
+            end
+
             command << "--username=#{Shellwords.shellescape(new_resource.username)}"
             command << "--password=#{Shellwords.shellescape(new_resource.password)}"
             command << "--environment=#{Shellwords.shellescape(new_resource.environment)}" if using_satellite_host?
             command << "--name=#{Shellwords.shellescape(new_resource.system_name)}" if new_resource.system_name
+            command << "--serverurl=#{Shellwords.shellescape(new_resource.server_url)}" if new_resource.server_url
+            command << "--baseurl=#{Shellwords.shellescape(new_resource.base_url)}" if new_resource.base_url
             command << "--auto-attach" if new_resource.auto_attach
+            command << "--servicelevel=#{Shellwords.shellescape(new_resource.service_level)}" if new_resource.service_level
+            command << "--release=#{Shellwords.shellescape(new_resource.release)}" if new_resource.release
             command << "--force" if new_resource.force
 
             return command.join(" ")

data/lib/chef/resource/support/client.erb

@@ -37,6 +37,13 @@ log_location <%= @log_location %>
 log_location <%= @log_location.inspect %>
   <% end -%>
 <% end -%>
+<%# These data_collector options are special as they have a '.' -%>
+<% unless @data_collector_server_url.nil? || @data_collector_server_url.empty? %>
+data_collector.server_url <%= @data_collector_server_url %>
+<% end %>
+<% unless @data_collector_token.nil? || @data_collector_token.empty? %>
+data_collector.token <%= @data_collector_token %>
+<% end %>
 <%# The code below is not DRY on purpose to improve readability -%>
 <% unless @start_handlers.empty? -%>
   # Do not crash if a start handler is missing / not installed yet

data/lib/chef/resource/windows_feature_powershell.rb

@@ -100,8 +100,8 @@ class Chef
             install_command << " -Source \"#{new_resource.source}\"" if new_resource.source
             install_command << " -IncludeManagementTools" if new_resource.management_tools
 
-            cmd = powershell_out!(install_command, timeout: new_resource.timeout)
-            Chef::Log.info(cmd.stdout)
+            cmd = powershell_exec!(install_command, timeout: new_resource.timeout)
+            Chef::Log.info(cmd.result)
 
             reload_cached_powershell_data # Reload cached powershell feature state
           end
@@ -115,8 +115,8 @@ class Chef
 
         unless features_to_remove.empty?
           converge_by("remove Windows feature#{"s" if features_to_remove.count > 1} #{features_to_remove.join(",")}") do
-            cmd = powershell_out!("Uninstall-WindowsFeature #{features_to_remove.join(",")}", timeout: new_resource.timeout)
-            Chef::Log.info(cmd.stdout)
+            cmd = powershell_exec!("Uninstall-WindowsFeature #{features_to_remove.join(",")}", timeout: new_resource.timeout)
+            Chef::Log.info(cmd.result)
 
             reload_cached_powershell_data # Reload cached powershell feature state
           end
@@ -132,8 +132,8 @@ class Chef
 
         unless features_to_delete.empty?
           converge_by("delete Windows feature#{"s" if features_to_delete.count > 1} #{features_to_delete.join(",")} from the image") do
-            cmd = powershell_out!("Uninstall-WindowsFeature #{features_to_delete.join(",")} -Remove", timeout: new_resource.timeout)
-            Chef::Log.info(cmd.stdout)
+            cmd = powershell_exec!("Uninstall-WindowsFeature #{features_to_delete.join(",")} -Remove", timeout: new_resource.timeout)
+            Chef::Log.info(cmd.result)
 
             reload_cached_powershell_data # Reload cached powershell feature state
           end
@@ -215,9 +215,8 @@ class Chef
         # fetch the list of available feature names and state in JSON and parse the JSON
         def parsed_feature_list
           # Grab raw feature information from WindowsFeature
-          raw_list_of_features = powershell_out!("Get-WindowsFeature | Select-Object -Property Name,InstallState | ConvertTo-Json -Compress", timeout: new_resource.timeout).stdout
-
-          Chef::JSONCompat.from_json(raw_list_of_features)
+          raw_list_of_features = powershell_exec!("Get-WindowsFeature | Select-Object -Property Name,InstallState", timeout: new_resource.timeout).result
+          raw_list_of_features || []
         end
 
         # add the features values to the appropriate array

data/lib/chef/resource/windows_task.rb

@@ -149,7 +149,6 @@ class Chef
       DOC
 
       allowed_actions :create, :delete, :run, :end, :enable, :disable, :change
-      default_action :create
 
       property :task_name, String, regex: [%r{\A[^/\:\*\?\<\>\|]+\z}],
         description: "An optional property to set the task name if it differs from the resource block's name. Example: `Task Name` or `/Task Name`",
@@ -182,10 +181,19 @@ class Chef
         default: false
 
       property :frequency_modifier, [Integer, String],
-        default: 1
+        default: 1,
+        description: <<~DOCS
+          * For frequency `:minute` valid values are 1 to 1439
+          * For frequency `:hourly` valid values are 1 to 23
+          * For frequency `:daily` valid values are 1 to 365
+          * For frequency `:weekly` valid values are 1 to 52
+          * For frequency `:monthly` valid values are `('FIRST', 'SECOND', 'THIRD', 'FOURTH', 'LAST')` OR `1-12`.
+            * e.g. If user want to run the task on `second week of the month` use `frequency_modifier` value as `SECOND`. Multiple values for weeks of the month should be comma separated e.g. `"FIRST, THIRD, LAST"`.
+            * To run task every (n) months use values 1 to 12.
+        DOCS
 
       property :frequency, Symbol, equal_to: %i{minute hourly daily weekly monthly once on_logon onstart on_idle none},
-        description: "The frequency with which to run the task."
+        description: "The frequency with which to run the task. Note: This property is required in Chef Infra Client 14.1 or later. Note: The `:once` value requires the `start_time` property to be set."
 
       property :start_day, String,
         description: "Specifies the first date on which the task runs in **MM/DD/YYYY** format.",
@@ -195,7 +203,14 @@ class Chef
         description: "Specifies the start time to run the task, in **HH:mm** format."
 
       property :day, [String, Integer],
-        description: "The day(s) on which the task runs."
+        description:  <<~DOCS
+        The day(s) on which the task runs.
+          * Use this property when setting `frequency` to `:monthly` or `:weekly`.
+          * Valid values with frequency `:weekly` are `MON`-`SUN` or `*`.
+          * Valid values with frequency `:monthly` are `1-31`, `MON`-`SUN`, and `LASTDAY`.
+          * Use `MON`-`SUN` or `LASTDAY` if you are setting `frequency_modifier` as "FIRST, SECOND, THIRD etc." else use 1-31.
+          * Multiple days should be comma separated. e.g `1, 2, 3` or `MON, WED, FRI`.
+        DOCS
 
       property :months, String,
         description: "The Months of the year on which the task runs, such as: `JAN, FEB` or `*`. Multiple months should be comma delimited. e.g. `Jan, Feb, Mar, Dec`."
@@ -961,7 +976,7 @@ class Chef
         end
       end
 
-      action :create do
+      action :create, description: "Creates a scheduled task, or updates an existing task if any property has changed." do
         set_command_and_arguments if new_resource.command
 
         if current_resource.exists
@@ -998,7 +1013,7 @@ class Chef
         end
       end
 
-      action :run do
+      action :run, description: "Runs a scheduled task." do
         if current_resource.exists
           logger.trace "#{new_resource} task exists"
           if current_resource.task.status == "running"
@@ -1013,7 +1028,7 @@ class Chef
         end
       end
 
-      action :delete do
+      action :delete, description: "Deletes a scheduled task." do
         if current_resource.exists
           logger.trace "#{new_resource} task exists"
           converge_by("delete scheduled task #{new_resource}") do
@@ -1026,7 +1041,7 @@ class Chef
         end
       end
 
-      action :end do
+      action :end, description: "Ends a scheduled task." do
         if current_resource.exists
           logger.trace "#{new_resource} task exists"
           if current_resource.task.status != "running"
@@ -1041,7 +1056,7 @@ class Chef
         end
       end
 
-      action :enable do
+      action :enable, description: "Enables a scheduled task." do
         if current_resource.exists
           logger.trace "#{new_resource} task exists"
           if current_resource.task.status == "not scheduled"
@@ -1058,7 +1073,7 @@ class Chef
         end
       end
 
-      action :disable do
+      action :disable, description: "Disables a scheduled task." do
         if current_resource.exists
           logger.info "#{new_resource} task exists"
           if %w{ready running}.include?(current_resource.task.status)

data/lib/chef/resource.rb

@@ -311,7 +311,7 @@ class Chef
     #   file '/foo.txt' do
     #     content 'hi'
     #     action :nothing
-    #     subscribes :create, '/bar.txt'
+    #     subscribes :create, bar
     #   end
     # @example Multiple resources by string
     #   file '/foo.txt' do
@@ -454,7 +454,7 @@ class Chef
     # @param arg [String] The umask to apply while converging the resource.
     # @return [Boolean] The umask to apply while converging the resource.
     #
-    property :umask, String,
+    property :umask, [String, Integer],
       desired_state: false,
       introduced: "16.2",
       description: "Set a umask to be used for the duration of converging the resource. Defaults to `nil`, which means to use the system umask. Unsupported on Windows because Windows lacks a direct equivalent to UNIX's umask."
@@ -1096,7 +1096,7 @@ class Chef
     rescue NameError => e
       # This can happen when attempting to load a provider in a platform-specific
       # environment where we have not required the necessary files yet
-      raise unless e.message =~ /uninitialized constant/
+      raise unless /uninitialized constant/.match?(e.message)
     end
 
     # Define a method to load up this resource's properties with the current

data/lib/chef/resource_reporter.rb

@@ -34,7 +34,7 @@ class Chef
       as_hash["after"]    = new_resource.state_for_resource_reporter
       as_hash["before"]   = current_resource ? current_resource.state_for_resource_reporter : {}
       as_hash["duration"] = ( action_record.elapsed_time * 1000 ).to_i.to_s
-      as_hash["delta"]    = new_resource.diff if new_resource.respond_to?("diff")
+      as_hash["delta"]    = new_resource.diff if new_resource.respond_to?(:diff)
       as_hash["delta"]    = "" if as_hash["delta"].nil?
 
       # TODO: rename as "action"

data/lib/chef/run_lock.rb

@@ -144,7 +144,7 @@ class Chef
         # If we support FD_CLOEXEC, then use it.
         # NB: ruby-2.0.0-p195 sets FD_CLOEXEC by default, but not
         # ruby-1.8.7/1.9.3
-        if Fcntl.const_defined?("F_SETFD") && Fcntl.const_defined?("FD_CLOEXEC")
+        if Fcntl.const_defined?(:F_SETFD) && Fcntl.const_defined?(:FD_CLOEXEC)
           runlock.fcntl(Fcntl::F_SETFD, runlock.fcntl(Fcntl::F_GETFD, 0) | Fcntl::FD_CLOEXEC)
         end
         # Flock will return 0 if it can acquire the lock otherwise it

data/lib/chef/secret_fetcher/azure_key_vault.rb

@@ -1,5 +1,7 @@
 require_relative "base"
 require_relative "../exceptions"
+require "json" unless defined?(JSON)
+require "net/http" unless defined?(Net::HTTP)
 require "uri" unless defined?(URI)
 
 class Chef
@@ -57,7 +59,7 @@ class Chef
       end
 
       def validate!
-        raise Chef::Exceptions::Secret::ConfigurationInvalid, "You may only specify one (these are mutually exclusive): :object_id, :client_id, or :mi_res_id" if [object_id, client_id, mi_res_id].select { |x| !x.nil? }.length > 1
+        raise Chef::Exceptions::Secret::ConfigurationInvalid, "You may only specify one (these are mutually exclusive): :object_id, :client_id, or :mi_res_id" if [object_id, client_id, mi_res_id].count { |x| !x.nil? } > 1
       end
 
       private
@@ -121,7 +123,7 @@ class Chef
           body["access_token"]
         when Net::HTTPBadRequest
           body = JSON.parse(response.body)
-          raise Chef::Exceptions::Secret::Azure::IdentityNotFound if body["error_description"] =~ /identity not found/i
+          raise Chef::Exceptions::Secret::Azure::IdentityNotFound if /identity not found/i.match?(body["error_description"])
         else
           body = JSON.parse(response.body)
           body["access_token"]

data/lib/chef/secret_fetcher/hashi_vault.rb

@@ -31,6 +31,10 @@ class Chef
     # :auth_method - one of :iam_role, :token.  default: :iam_role
     # :vault_addr - the address of a running Vault instance, eg https://vault.example.com:8200
     #
+    # For `:approle`: one of `:approle_name` or `:approle_id`
+    #     `:approle_name`: The name of the approle to use for authentication.  When specified, associated `:approle_id` will be found via query to Vault instance.
+    #     `:approle_id`: The ID of the approle to use for authentication, requires `:approle_secret_id`
+    #     `:approle_secret_id`: The Vault `secret_id` associated with the provided `:approle_name` or `:approle_id`.  When specified, prevents need to create `:secret_id` with `:approle_name`.
     # For `:token` auth: `:token` - a Vault token valid for authentication.
     #
     # For `:iam_role`:  `:role_name` - the name of the role in Vault that was created
@@ -47,14 +51,25 @@ class Chef
     #
     # @example
     #
-    # fetcher = SecretFetcher.for_service(:hashi_vault, { role_name: "testing-role", vault_addr: https://localhost:8200}, run_context )
+    # fetcher = SecretFetcher.for_service(:hashi_vault, { auth_method: :iam_role, role_name: "testing-role", vault_addr: https://localhost:8200}, run_context )
     # fetcher.fetch("secretkey1")
     #
     # @example
     #
-    # fetcher = SecretFetcher.for_service(:hashi_vault, { auth_method: :token, token: "s.1234abcdef", vault_addr: https://localhost:8200}, run_context )
+    # fetcher = SecretFetcher.for_service(:hashi_vault, { auth_method: :token, token: "s.1234abcdef", vault_addr: https://localhost:8200}, approle: 'approle_name', run_context )
     # fetcher.fetch("secretkey1")
-    SUPPORTED_AUTH_TYPES = %i{iam_role token}.freeze
+    #
+    # @example
+    #
+    # fetcher = SecretFetcher.for_service(:hashi_vault, { auth_method: :approle, approle_id: "11111111-abcd-1111-abcd-111111111111", approle_secret_id: "22222222-abcd-2222-abcd-222222222222", vault_addr: https://localhost:8200}, run_context )
+    # fetcher.fetch("secretkey1")
+    #
+    # @example
+    #
+    # fetcher = SecretFetcher.for_service(:hashi_vault, { auth_method: :approle, approle_name: "testing-role", token: "s.1234abcdef", vault_addr: https://localhost:8200}, run_context )
+    # fetcher.fetch("secretkey1")
+    #
+    SUPPORTED_AUTH_TYPES = %i{approle iam_role token}.freeze
     class HashiVault < Base
 
       # Validate and authenticate the current session using the configured auth strategy and parameters
@@ -67,6 +82,25 @@ class Chef
         Vault.namespace = config[:namespace] unless config[:namespace].nil?
 
         case config[:auth_method]
+        when :approle
+          unless config[:approle_name] || config[:approle_id]
+            raise Chef::Exceptions::Secret::ConfigurationInvalid.new("You must provide the :approle_name or :approle_id in the configuration with :auth_method set to :approle")
+          end
+
+          # When :approle_id and :approle_secret_id are both specified, all pieces are present which are needed to authenticate using an approle.
+          #  If either is missing, we need to authenticate to Vault to get the missing pieces with the :approle_name and optionally :token.
+          unless config[:approle_id] && config[:approle_secret_id]
+            if config[:approle_name].nil?
+              raise Chef::Exceptions::Secret::ConfigurationInvalid.new("You must provide the :approle_name in the configuration when :approle_id and :approle_secret_id are not both present with :auth_method set to :approle")
+            end
+
+            Vault.token = config[:token] unless config[:token].nil?
+          end
+
+          approle_id = config[:approle_id] || Vault.approle.role_id(config[:approle_name])
+          approle_secret_id = config[:approle_secret_id] || Vault.approle.create_secret_id(config[:approle_name]).data[:secret_id]
+
+          Vault.auth.approle(approle_id, approle_secret_id)
         when :token
           if config[:token].nil?
             raise Chef::Exceptions::Secret::ConfigurationInvalid.new("You must provide the token in the configuration as :token")

data/lib/chef/version.rb

@@ -23,7 +23,7 @@ require_relative "version_string"
 
 class Chef
   CHEF_ROOT = File.expand_path("..", __dir__)
-  VERSION = Chef::VersionString.new("17.7.22")
+  VERSION = Chef::VersionString.new("17.9.26")
 end
 
 #